Special Characters in Proxy Passwords

A password containing @ or # can break a hand-built proxy URL even when the credentials are correct. Those characters already have meanings in a URL, so the client may parse part of the password as the hostname or fragment.

Encode the two credential fields separately

This example keeps the URL's structural separators intact and encodes only the username and password:

from urllib.parse import quote

username = "user@team"
password = "p:a/ss#?"
proxy_url = (
    "http://"
    + quote(username, safe="")
    + ":"
    + quote(password, safe="")
    + "@203.0.113.10:8080"
)

Use your actual endpoint and credentials. The address shown is a documentation example. The empty safe argument matters: quote normally leaves a slash unescaped, but a slash inside this credential field needs to be encoded.

Do not encode the whole proxy URL. Encoding the scheme separators and the @ between credentials and host destroys the structure you were trying to preserve. Also avoid encoding an already encoded password a second time.

Use the result with Requests

import requests

response = requests.get(
    "https://example.com/",
    proxies={"http": proxy_url, "https": proxy_url},
    timeout=(5, 15),
)
response.raise_for_status()

If the request still fails, inspect whether the proxy rejects the login or whether the client failed earlier while parsing or connecting. A 407 challenge and an invalid URL are different failures.

HTTPX can keep authentication separate

An HTTPX Proxy object can take the endpoint and credentials as separate arguments:

import httpx

proxy = httpx.Proxy(
    "http://203.0.113.10:8080",
    auth=("user@team", "p:a/ss#?"),
)

with httpx.Client(proxy=proxy, trust_env=False, timeout=15) as client:
    response = client.get("https://example.com/")
    response.raise_for_status()

This avoids constructing the userinfo part yourself. It does not encrypt the credentials independently of the proxy connection or choose an authentication method supported by every service.

If a free list supplies only an IP and port, this example is not a source of default credentials. Use authentication only when the operator actually provides an account. Keep credential-bearing URLs out of shared logs and source files.